ASP.NET Core Authorization with Microsoft Entra ID

Question

We have an ASP.NET Core MVC application and want to migrate from on-premise Active Directory to Microsoft Entra ID. Authentication works without any issues, but Authorization does not.

Currently, we use [Authorize(Roles = "GroupX")] or HttpContext.User.IsInRole("GroupX") to check if a user is in a certain group. These groups are security groups in Entra ID.

I replaced

builder.Services 
       .AddAuthentication(IISDefaults.AuthenticationScheme)

with

builder.Services
       .AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
       .AddMicrosoftIdentityWebApp(builder.Configuration)

But the user gets redirected to /Account/AccessDenied even when they are assigned to the group.

I also noticed that HttpContext.User.Claims is missing all the roles/groups.

Please share your error message.What is the version of your App? — Harshitha Veeramalla
– Harshitha Veeramalla, Commented Jan 20 at 10:16
Don't think it's as simple as a one-line change. learn.microsoft.com/en-us/aspnet/core/security/authentication/… — ADyson
– ADyson, Commented Jan 20 at 10:33
@Harshitha There is no error message. As I wrote, the user gets redirected to /Account/AccessDenied as if they were not in the group. We use .NET 8.0. — M. Schuepbach
– M. Schuepbach, Commented Jan 20 at 10:53
What does your Manifest => GroupMembershipClaims has ? Image. Assign security group to it and check once. — Harshitha Veeramalla
– Harshitha Veeramalla, Commented Jan 20 at 11:40

M. Schuepbach · Accepted Answer · 2025-02-07 15:12:51Z

0

I discovered these Examples which helped a lot.

We solved our issue by using App Roles and combining them with security groups in Microsoft Entra.

Then, in our Program.cs we replaced

builder.Services 
       .AddAuthentication(IISDefaults.AuthenticationScheme)

with

JwtSecurityTokenHandler.DefaultMapInboundClaims = false;

builder.Services
    .AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration);

builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    options.TokenValidationParameters.RoleClaimType = "roles";
});

answered Feb 7 at 15:12

M. Schuepbach

277 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Core Authorization with Microsoft Entra ID

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related